Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cve[email protected]CVE-2012-1963
HistoryJul 18, 2012 - 10:26 a.m.

CVE-2012-1963

2012-07-1810:26:49
CWE-264
[email protected]
web.nvd.nist.gov
35
content security policy
csp
mozilla firefox
thunderbird
openid
oauth 2.0
violation report

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

9.3 High

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

73.6%

JSON

The Content Security Policy (CSP) functionality in Mozilla Firefox 4.x through 13.0, Firefox ESR 10.x before 10.0.6, Thunderbird 5.0 through 13.0, Thunderbird ESR 10.x before 10.0.6, and SeaMonkey before 2.11 does not properly restrict the strings placed into the blocked-uri parameter of a violation report, which allows remote web servers to capture OpenID credentials and OAuth 2.0 access tokens by triggering a violation.

Affected configurations

NVD
Node
mozillafirefoxMatch4.0
OR
mozillafirefoxMatch4.0beta1
OR
mozillafirefoxMatch4.0beta10
OR
mozillafirefoxMatch4.0beta11
OR
mozillafirefoxMatch4.0beta12
OR
mozillafirefoxMatch4.0beta2
OR
mozillafirefoxMatch4.0beta3
OR
mozillafirefoxMatch4.0beta4
OR
mozillafirefoxMatch4.0beta5
OR
mozillafirefoxMatch4.0beta6
OR
mozillafirefoxMatch4.0beta7
OR
mozillafirefoxMatch4.0beta8
OR
mozillafirefoxMatch4.0beta9
OR
mozillafirefoxMatch4.0.1
OR
mozillafirefoxMatch5.0
OR
mozillafirefoxMatch5.0.1
OR
mozillafirefoxMatch6.0
OR
mozillafirefoxMatch6.0.1
OR
mozillafirefoxMatch6.0.2
OR
mozillafirefoxMatch7.0
OR
mozillafirefoxMatch7.0.1
OR
mozillafirefoxMatch8.0
OR
mozillafirefoxMatch8.0.1
OR
mozillafirefoxMatch9.0
OR
mozillafirefoxMatch9.0.1
OR
mozillafirefoxMatch11.0
OR
mozillafirefoxMatch12.0
OR
mozillafirefoxMatch12.0beta6
OR
mozillafirefoxMatch13.0
Node
mozillafirefox_esrMatch10.0
OR
mozillafirefox_esrMatch10.0.1
OR
mozillafirefox_esrMatch10.0.2
OR
mozillafirefox_esrMatch10.0.3
OR
mozillafirefox_esrMatch10.0.4
OR
mozillafirefox_esrMatch10.0.5
Node
mozillathunderbirdMatch5.0
OR
mozillathunderbirdMatch6.0
OR
mozillathunderbirdMatch6.0.1
OR
mozillathunderbirdMatch6.0.2
OR
mozillathunderbirdMatch7.0
OR
mozillathunderbirdMatch7.0.1
OR
mozillathunderbirdMatch8.0
OR
mozillathunderbirdMatch9.0
OR
mozillathunderbirdMatch9.0.1
OR
mozillathunderbirdMatch10.0
OR
mozillathunderbirdMatch10.0.1
OR
mozillathunderbirdMatch10.0.2
OR
mozillathunderbirdMatch10.0.3
OR
mozillathunderbirdMatch10.0.4
OR
mozillathunderbirdMatch11.0
OR
mozillathunderbirdMatch12.0
OR
mozillathunderbirdMatch13.0
Node
mozillathunderbird_esrMatch10.0
OR
mozillathunderbird_esrMatch10.0.1
OR
mozillathunderbird_esrMatch10.0.2
OR
mozillathunderbird_esrMatch10.0.3
OR
mozillathunderbird_esrMatch10.0.4
OR
mozillathunderbird_esrMatch10.0.5
Node
mozillaseamonkeyRange≤2.10
OR
mozillaseamonkeyMatch1.0
OR
mozillaseamonkeyMatch1.0alpha
OR
mozillaseamonkeyMatch1.0beta
OR
mozillaseamonkeyMatch1.0.1
OR
mozillaseamonkeyMatch1.0.2
OR
mozillaseamonkeyMatch1.0.3
OR
mozillaseamonkeyMatch1.0.4
OR
mozillaseamonkeyMatch1.0.5
OR
mozillaseamonkeyMatch1.0.6
OR
mozillaseamonkeyMatch1.0.7
OR
mozillaseamonkeyMatch1.0.8
OR
mozillaseamonkeyMatch1.0.9
OR
mozillaseamonkeyMatch1.1
OR
mozillaseamonkeyMatch1.1alpha
OR
mozillaseamonkeyMatch1.1beta
OR
mozillaseamonkeyMatch1.1.1
OR
mozillaseamonkeyMatch1.1.2
OR
mozillaseamonkeyMatch1.1.3
OR
mozillaseamonkeyMatch1.1.4
OR
mozillaseamonkeyMatch1.1.5
OR
mozillaseamonkeyMatch1.1.6
OR
mozillaseamonkeyMatch1.1.7
OR
mozillaseamonkeyMatch1.1.8
OR
mozillaseamonkeyMatch1.1.9
OR
mozillaseamonkeyMatch1.1.10
OR
mozillaseamonkeyMatch1.1.11
OR
mozillaseamonkeyMatch1.1.12
OR
mozillaseamonkeyMatch1.1.13
OR
mozillaseamonkeyMatch1.1.14
OR
mozillaseamonkeyMatch1.1.15
OR
mozillaseamonkeyMatch1.1.16
OR
mozillaseamonkeyMatch1.1.17
OR
mozillaseamonkeyMatch1.1.18
OR
mozillaseamonkeyMatch1.1.19
OR
mozillaseamonkeyMatch1.5.0.8
OR
mozillaseamonkeyMatch1.5.0.9
OR
mozillaseamonkeyMatch1.5.0.10
OR
mozillaseamonkeyMatch2.0
OR
mozillaseamonkeyMatch2.0alpha_1
OR
mozillaseamonkeyMatch2.0alpha_2
OR
mozillaseamonkeyMatch2.0alpha_3
OR
mozillaseamonkeyMatch2.0beta_1
OR
mozillaseamonkeyMatch2.0beta_2
OR
mozillaseamonkeyMatch2.0rc1
OR
mozillaseamonkeyMatch2.0rc2
OR
mozillaseamonkeyMatch2.0.1
OR
mozillaseamonkeyMatch2.0.2
OR
mozillaseamonkeyMatch2.0.3
OR
mozillaseamonkeyMatch2.0.4
OR
mozillaseamonkeyMatch2.0.5
OR
mozillaseamonkeyMatch2.0.6
OR
mozillaseamonkeyMatch2.0.7
OR
mozillaseamonkeyMatch2.0.8
OR
mozillaseamonkeyMatch2.0.9
OR
mozillaseamonkeyMatch2.0.10
OR
mozillaseamonkeyMatch2.0.11
OR
mozillaseamonkeyMatch2.0.12
OR
mozillaseamonkeyMatch2.0.13
OR
mozillaseamonkeyMatch2.0.14
OR
mozillaseamonkeyMatch2.1
OR
mozillaseamonkeyMatch2.1alpha1
OR
mozillaseamonkeyMatch2.1alpha2
OR
mozillaseamonkeyMatch2.1alpha3
OR
mozillaseamonkeyMatch2.1beta1
OR
mozillaseamonkeyMatch2.1beta2
OR
mozillaseamonkeyMatch2.1beta3
OR
mozillaseamonkeyMatch2.1rc1
OR
mozillaseamonkeyMatch2.1rc2

References

Related

openvas 42
cvelist 1
mozilla 1
prion 1
nvd 1
ubuntucve 1
suse 7
nessus 35
oraclelinux 2
redhat 2
ubuntu 3
centos 2
veracode 16
securityvulns 1
freebsd 1
gentoo 1
openvas
openvas
Mozilla Firefox Security Advisory (MFSA2012-53) - Linux
2021-11-11 00:00:00
Mozilla Products Multiple Vulnerabilities - July12 (Windows)
2012-07-23 00:00:00
Mozilla Products Multiple Vulnerabilities - July12 (Mac OS X)
2012-07-23 00:00:00
cvelist
cvelist
CVE-2012-1963
2012-07-18 10:00:00
mozilla
mozilla
Content Security Policy 1.0 implementation errors cause data leakage — Mozilla
2012-07-17 00:00:00
prion
prion
Design/Logic Flaw
2012-07-18 10:26:00
nvd
nvd
CVE-2012-1963
2012-07-18 10:26:49
ubuntucve
ubuntucve
CVE-2012-1963
2012-07-17 00:00:00
suse
suse
MozillaThunderbird: update to Thunderbird 14.0 (important)
2012-07-27 13:08:18
seamonkey: Update to Seamonkey 2.11 (important)
2012-08-01 18:08:34
Security update for Mozilla Firefox (important)
2012-07-21 01:08:17
nessus
nessus
Thunderbird 10.0.x < 10.0.6 Multiple Vulnerabilities (Mac OS X)
2012-07-19 00:00:00
Mozilla Thunderbird 10.0.x < 10.0.6 Multiple Vulnerabilities
2012-07-19 00:00:00
openSUSE Security Update : MozillaThunderbird (openSUSE-SU-2012:0917-1)
2014-06-13 00:00:00
oraclelinux
oraclelinux
thunderbird security update
2012-07-17 00:00:00
firefox security update
2012-07-17 00:00:00
redhat
redhat
(RHSA-2012:1089) Critical: thunderbird security update
2012-07-17 00:00:00
(RHSA-2012:1088) Critical: firefox security update
2012-07-17 00:00:00
ubuntu
ubuntu
Thunderbird vulnerabilities
2012-07-17 00:00:00
ubufox update
2012-07-18 00:00:00
Firefox vulnerabilities
2012-07-17 00:00:00
centos
centos
thunderbird security update
2012-07-17 21:25:02
firefox, xulrunner security update
2012-07-17 20:41:16
veracode
veracode
Spoofing Vulnerability
2019-05-02 04:42:26
Use-After-Free (UAF)
2019-05-02 04:42:25
Denial Of Service (DoS)
2019-05-02 04:42:25
securityvulns
securityvulns
Mozilla Firefox / Thunderbird / Seamonkey multiple security vulnerabilities
2012-08-13 00:00:00
freebsd
freebsd
mozilla -- multiple vulnerabilities
2012-07-17 00:00:00
gentoo
gentoo
Mozilla Products: Multiple vulnerabilities
2013-01-08 00:00:00

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

9.3 High

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

73.6%

JSON
Related for CVE-2012-1963
openvas42cvelist1mozilla1prion1nvd1ubuntucve1suse7nessus35oraclelinux2redhat2ubuntu3centos2veracode16securityvulns1freebsd1gentoo1